← All posts

Compliance & Regulation

433 posts on compliance & regulation.

Singapore PDPA AI Audit Evidence: The Records Behind a Defensible AI Deployment

Singapore PDPA AI audit evidence starts with the records behind each deployed request: purpose, notice, consent or exception, originating identity, data class, destination, policy outcome, retention and breach assessment. This guide builds the evidence package around the PDPC obligations and its 1 March 2024 AI guidance, then separates runtime proof from privacy work that stays off the request path.

complianceregulationai-governanceai-complianceauditpolicy-enforcement
Read post →

Singapore PDPA AI Compliance Checklist: 12 Items With a Completion Test

This Singapore PDPA AI compliance checklist turns the PDPC obligations into twelve dependency-ordered actions for an organisation deploying AI. Each item names an owner, an objective completion test and the evidence to retain, covering scope, purpose, notification, accountability, protection, overseas transfers, retention, access and breach response without assigning legal work to an HTTP gateway.

complianceregulationai-complianceai-governanceauditpolicy-enforcement
Read post →

Singapore PDPA AI Controls Mapping: Obligation, Owner, Test and Evidence

This Singapore PDPA AI controls mapping connects the Commission’s obligations to a control objective, accountable owner, implementation point, test and evidence artifact. It covers purpose, notification, consent, accountability, protection, accuracy, retention, overseas transfers, access, correction and breach notification, with Full, Partial and Outside verdicts that keep a request gateway inside its real boundary.

complianceregulationai-governanceai-compliancepolicy-enforcementaudit
Read post →

StateRAMP AI Audit Evidence: Build a Package an Assessor Can Replay

StateRAMP AI audit evidence has to connect the authorization boundary, NIST SP 800-53 Revision 5 control narrative, tested AI request, and retained decision record. This guide organizes the package around sampling, replay, custody, integrity, and retrieval so a 3PAO can trace one authenticated caller through an LLM transaction without reconstructing the event from unrelated logs.

ai-complianceai-governanceauditforensic-auditnistzero-trust
Read post →

StateRAMP AI Compliance Checklist: 10 Tests for the Revision 5 Package

This StateRAMP AI compliance checklist turns the current GovRAMP Revision 5 package into 10 gradable actions for AI-enabled cloud services. Each item names an owner, required evidence, and a pass condition covering the assessed boundary, AI disclosures, identity, model routes, prompt protection, audit records, continuous monitoring, incident drills, and responsibility gaps.

ai-complianceai-governancecomplianceauditnistzero-trust
Read post →

StateRAMP AI Controls Mapping: Revision 5 Coverage at the LLM Boundary

This StateRAMP AI controls mapping connects selected NIST SP 800-53 Revision 5 controls to the authenticated HTTP request path between an application and an LLM. It names the control objective, implementation point, owner, test, evidence, and coverage level, then separates gateway contributions from IAM, platform, model, governance, and incident-response responsibilities.

ai-complianceai-governancenistarchitecturepolicy-enforcementzero-trust
Read post →

Switzerland FADP AI Audit Evidence: Build the Record Before the Review

The Swiss FADP has applied to AI-supported processing since 1 September 2023. An evidence package has to connect each live model route to purpose, recipients, foreign disclosures, security measures, impact assessment findings and automated-decision rights. This guide builds that package around traceable samples rather than policy statements.

complianceregulationai-complianceai-governanceauditai-security
Read post →

Switzerland FADP AI Controls Mapping: Duty, Owner, Test and Evidence

The Swiss FADP applies directly to AI-supported personal-data processing. This mapping connects Articles 6 through 25 to a control objective, accountable owner, implementation point, test and evidence artifact. It marks gateway coverage as full, partial or outside scope so legal duties remain with legal owners and request-path controls stay technically defensible.

complianceregulationai-complianceai-governancepolicy-enforcementai-security
Read post →

Texas TRAIGA AI Audit Evidence: Build the Eight-Part Attorney General File

Texas TRAIGA took effect on 1 January 2026 and gives the Attorney General exclusive enforcement authority. The enacted law identifies eight categories of documentation the Attorney General may request after a consumer complaint, then gives a 60-day cure process with supporting documentation. This guide turns those statutory requests into a defensible evidence file without inventing a universal logging mandate.

complianceregulationai-complianceai-governanceauditpolicy-enforcement
Read post →

Texas TRAIGA AI Controls Mapping: Requirement, Owner, Test and Evidence

Texas TRAIGA took effect on 1 January 2026 and combines targeted use prohibitions with complaint-driven Attorney General enforcement. This mapping connects enacted HB 149 requirements to control objectives, accountable owners, implementation points, tests and evidence. It marks HTTP gateway coverage as full, partial or outside scope and keeps legal intent, notices, training data and metrics with their proper owners.

complianceregulationai-complianceai-governancepolicy-enforcementai-security
Read post →

Texas TRAIGA AI Compliance Checklist: 10 Tests for Enacted HB 149

Texas House Bill 149 took effect on 1 January 2026. This ten-item TRAIGA checklist follows the enacted law: scope and role, targeted disclosure, prohibited uses, complaint readiness, the Attorney General’s eight information categories, testing, safeguards and the 60-day cure file. Each item names an owner, evidence artifact and objective completion test without inventing a universal per-decision logging duty.

complianceregulationai-complianceai-governanceauditpolicy-enforcement
Read post →

TISAX AI Audit Evidence: Build the Sample Around Actual Model Traffic

TISAX AI audit evidence should connect the VDA ISA 6.0.3 requirements for approved external services, risk management, access control, event logging and supplier assurance to the AI requests that actually crossed the assessment scope. This guide builds a sample an assessor can reconstruct while keeping contracts, workforce controls and cloud configuration with their proper owners.

complianceai-complianceai-governanceauditpolicy-enforcementai-security
Read post →